Author Archives: Myonlinesecurity

Spoofed Santander You have a new secure message waiting malspam delivers Trickbot banking trojan

Posted on by

An email with the subject of You have a new secure message waiting pretending to come from Santander  but actually coming from a look alike domain Santander <pleasedonotreply@santandersecuremessage.com> with a malicious word doc attachment  is today’s latest spoof of a well known company, bank or public authority delivering Trickbot banking Trojan They … Continue reading → Continue reading Spoofed Santander You have a new secure message waiting malspam delivers Trickbot banking trojan→

more fake receipts and payment receipt emails deliver globe ransomware

Posted on by

Continuing with the never ending series of malware downloaders pretending to be a payment receipt  or a receipt is an email with the subject of  Receipt 21426 coming or pretending to come from donotreply@random email addresses with a  zip attachment containing a .vbs file  that delivers globe ransomware. The zip name corresponds with … Continue reading → Continue reading more fake receipts and payment receipt emails deliver globe ransomware→

Scanned image from MX-2600N with password protected word docs deliver malware

Posted on by

Back to an old regular email template today with an email with the subject of  Scanned image from MX-2600N pretending to come from noreply@your own email address  with a malicious word doc  delivering malware. I am not sure what it is yet but will either be a banking Trojan like Trickbot … Continue reading → Continue reading Scanned image from MX-2600N with password protected word docs deliver malware→

Emotet / Geodo delivered via fake invoices using updated word docs with encoded sections

Posted on by

Following on from THIS fake invoice email is a newer version with a different word doc at the end of the link in the email. Today’s  email with the subject of re: Invoice 622806 pretending to come from  senders with a known connection to the recipient. The link in the email … Continue reading → Continue reading Emotet / Geodo delivered via fake invoices using updated word docs with encoded sections→

Invoice notification with id number: 40533 delivers malware

Posted on by

An email with the subject of  Invoice notification with id number: 40533 pretending to come from random senders with a link in the email to a malicious word doc   delivers some sort of malware. I am not sure what these are but am guessing at possibly Emotet banking Trojan They are using … Continue reading → Continue reading Invoice notification with id number: 40533 delivers malware→

Spoofed HSBC Account secure documents malspam delivers trickbot

Posted on by

An email with the subject of Account secure documents pretending to come from HSBC but actually coming from a look alike domain <noreply@hsbcdocs.co.uk>  with a malicious word doc attachment  is today’s latest spoof of a well known company, bank or public authority delivering Trickbot banking Trojan They are using email addresses and … Continue reading → Continue reading Spoofed HSBC Account secure documents malspam delivers trickbot→

Fake Telstra bill malspam delivers Trickbot banking Trojan via multi stage download

Posted on by

Another Trickbot campaign overnight last night UK time. Pretends to be a bill coming from notifications@in.telstra.com.au. These have a slightly devious download mechanism. You get a wsf file in zip to start with. That has a hardcoded single site in the file. That downloads a .js file which has 4 or sometimes … Continue reading → Continue reading Fake Telstra bill malspam delivers Trickbot banking Trojan via multi stage download→

return of Russia Dating sexy pics scam spam attempting to deliver malware -fail

Posted on by

I have seen a few clueless and inept attempts to deliver malware in my time, but this must still  rank as one of the most stupid failures. I posted about these several months ago I have seen the odd one since then, but today we see another  spam run of these. … Continue reading → Continue reading return of Russia Dating sexy pics scam spam attempting to deliver malware -fail→

spoofed unlimitedhorizon.co.uk Voice Message Attached from 01258895166 – name unavailable malspam delivers Trickbot banking trojan

Posted on by

Next in today’s Trickbot banking Trojans coming via the Necurs botnet is an email with the subject of   Voice Message Attached from 01258895166 – name unavailable [ random numbered]  pretending to come from  vm@unlimitedhorizon.co.uk  with a zip attachment  which downloads They use email addresses and subjects that will entice a user to … Continue reading → Continue reading spoofed unlimitedhorizon.co.uk Voice Message Attached from 01258895166 – name unavailable malspam delivers Trickbot banking trojan→

Web designers own site compromised to use in Phishing campaign

Posted on by

We see lots of phishing attempts for email credentials. This one pretends to be a message from Email  support to update your email. They use email addresses and subjects that will entice a user to read the email and open the attachment. A very high proportion are being targeted at … Continue reading → Continue reading Web designers own site compromised to use in Phishing campaign→